Control of documented information

What the baseline asks

Keep control of the documented information the BCMS and the standard call for, so that it can be found and used where and when it is needed and is properly protected. This covers how it is distributed, accessed, retrieved and used; how it is stored and preserved, legibility included; how changes are controlled; and how long it is kept and how it is disposed of. Documented information that comes from outside but on which the BCMS relies must also be identified and controlled.

What it means when the service runs in the cloud

Control of documented information means the right version is available to the right people at the wrong moment's speed. Store the provider schedules and exit plans where the incident desk can reach them offline.

Evidence an auditor or a customer asks for

• Access and distribution controls with evidence of enforcement
• Storage and preservation arrangements including offline or alternate site availability
• Version control history and retention and disposition schedule
• Register of controlled external origin documents

Common gaps in a cloud estate

• Plans stored only on the corporate network, so they are unavailable in the scenario they exist for
• External origin documents such as supplier contracts and regulator guidance left uncontrolled
• Protection considered for confidentiality but not for integrity or loss
• Superseded plans still in circulation at response team locations

Done well, what the file shows

Done well, this clause leaves a access and distribution controls with evidence of enforcement that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Check the incident desk can reach the current plan and contract when the provider portal is down.